CVE-2026-96766Published
GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-96766 · Microsoft / collected KEV context
cve-program · CVE-2026-96766
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bc743651-cfbc-487b-9d1b-9aab6d3a57b7?source=cve
- https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.182/includes/custom-fields/input-functions-aui.php#L2278
- https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.182/includes/business-hours-functions.php#L965
- https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.182/includes/class-geodir-post-data.php#L1661
- https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.182/includes/class-geodir-ajax.php#L821
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3710682%40geodirectory&new=3710682%40geodirectory
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.